Poland's energy grid, a critical component of the country's infrastructure, was targeted by wiper malware in an apparent attempt to disrupt electricity delivery operations. The attack, which occurred during the last week of December, is believed to have been carried out by Russian state hackers using the malware known as DynoWiper.
According to security firm ESET, the malware was used to remove computer data and clear digital code from servers with the goal of destroying operations completely. However, unlike previous examples of wiper malware used by Russia, including NotPetya, which caused widespread disruption and estimated losses of $10 billion, DynoWiper failed to knock out electricity in Poland.
ESET researchers attribute the attack to the Russia-aligned Sandworm APT group with medium confidence due to similarities with previous attacks. However, unlike other instances where wiper malware has been used to target critical infrastructure, such as Ukraine's power grid in 2015 and satellite modems in 2022, DynoWiper appears to have fallen short of its intended goal.
One possible reason for the attack's failure is that Russian hackers may have planned it as a "dry run" without expecting robust cyber defenses in Poland. Alternatively, it is also possible that the wiper malware was designed to fail and send a message without provoking Polish allies. Regardless of the motivation behind the attack, the incident highlights the increasing use of wiper malware by Russia to disrupt critical infrastructure and underscores the need for improved cybersecurity measures to protect against such threats.
The fact that the attack occurred on the 10th anniversary of Ukraine's energy grid attack in December 2015 adds another layer of complexity to the situation. Both incidents demonstrate the ongoing use of destructive attacks by Russian state hackers aimed at adversaries, including Poland and Ukraine, which may be intended to send a message or disrupt operations without causing immediate physical harm.
According to security firm ESET, the malware was used to remove computer data and clear digital code from servers with the goal of destroying operations completely. However, unlike previous examples of wiper malware used by Russia, including NotPetya, which caused widespread disruption and estimated losses of $10 billion, DynoWiper failed to knock out electricity in Poland.
ESET researchers attribute the attack to the Russia-aligned Sandworm APT group with medium confidence due to similarities with previous attacks. However, unlike other instances where wiper malware has been used to target critical infrastructure, such as Ukraine's power grid in 2015 and satellite modems in 2022, DynoWiper appears to have fallen short of its intended goal.
One possible reason for the attack's failure is that Russian hackers may have planned it as a "dry run" without expecting robust cyber defenses in Poland. Alternatively, it is also possible that the wiper malware was designed to fail and send a message without provoking Polish allies. Regardless of the motivation behind the attack, the incident highlights the increasing use of wiper malware by Russia to disrupt critical infrastructure and underscores the need for improved cybersecurity measures to protect against such threats.
The fact that the attack occurred on the 10th anniversary of Ukraine's energy grid attack in December 2015 adds another layer of complexity to the situation. Both incidents demonstrate the ongoing use of destructive attacks by Russian state hackers aimed at adversaries, including Poland and Ukraine, which may be intended to send a message or disrupt operations without causing immediate physical harm.